The present invention relates to computer systems and software and more particularly to a method and system to correlate and consolidate a plurality of events that may each be emitted by one of a plurality of components of an event producer in response to an incident that affects the event producer.
Software applications or event producers are typically complex combinations of multiple software components. An application may be a “vertical application,” a “horizontal application” or a combination of both. A vertical application may be formed by a software stack consisting of multiple components and subcomponents that are tightly coupled to provide a unique and coordinated set of services. A horizontal application may be a business application or software solution consisting of multiple distributed components that are loosely coupled to provide a set of coordinated services.
The reporting of a detected incident, which may be a situation or condition, in an application typically does not result in the generation or emission of a single event, but rather the emission of multiple events, one from each component of the application to an event consumer. Each of these events attempts to describe the detected incident but from the perspective of the component emitting the event. The events emitted provide information only within the scope of the emitting software component with little or no knowledge of how that event and the services provided by the component integrate into the overall software application offerings and solutions. The events emitted by the software component need to be integrated and correlated with the events emitted by other software components in the application or solution in order for an event consumer or the like to effectively resolve or remedy the incident.
In current systems, event consumers need to be able to consume or integrate and analyze all of the events emitted by each of the components of an application or event producer to fully understand the underlying incident that triggered the event. In order to do this, event consumers need to have the data or knowledge to correlate all the events related to a situation and to determine the underlying situation or cause of the events by analyzing the detailed contents of each event from the perspective of the emitting component. Equipping or designing event consumers that can correlate and analyze multiple events from different application components are becoming increasingly difficult, if not impossible. Deployed systems are becoming increasingly complex and heterogeneous. Additionally, these systems need to be able to quickly and efficiently add new applications and application components. The increasing amount of deployed software and the volume of events that may be emitted can over stress the ability of event consumers to interpret and analyze the data contained in the events being received, and more importantly, to identify which events may be meaningful and require action.
The knowledge or data needed to interpret these events needs to be distributed with the event consumers so that each event consumer can understand the construction of the application including the application components and the perspective of these components in reporting an incident. The volume of knowledge or data that needs to be distributed and maintained further increases the complexity and cost of such systems.
FIG. 1 illustrates an example of a current system 100 to evaluate and analyze events 102-106. Each event 102-106 may be emitted or generated by a respective component 108-112 of an application 114 in response to an incident 116 affecting the application 114. The incident 116 may be any action or occurrence detected by the application 114 or program. Examples of an incident may be a user action, such as clicking a mouse button or pressing a key, a system occurrence , such as a fault, an interrupt, running out of memory, timeout of an operation or similar system related occurrence, or a business event, such as a transaction checkpoint or auditable condition. Each component 108-112 emits the associated event 102-106 reporting the incident 116 based on the component's particular perspective.
Each event 102-106 may be applied to an adapter 118 to adapt or transform each event 102-106 into a format, illustrated by adapted events 120-124 that can be understood by an event consumer 126. The event consumer 126 may be an event management system, such as IBM® Tivoli® Event Console, Hewlett Packard® OpenView®, or a Common Information Model (CIM) Manager, computer operating system, consuming application or the like. IBM and Tivoli are trademarks of International Business Machines Corporation in the United States, other countries, or both. Hewlett Packard and OpenView are trademarks of Hewlett Packard Company in the United States, other countries, or both. As previously discussed, special knowledge 128 or data needs to be distributed with the event consumer 126 so that the event consumer 126 can understand and interpret the transformed events 120-124 to provide an analysis or solution 130 for the incident 116.
FIG. 2 illustrates another example of a current system 200 to evaluate and analyze events 202-206 emitted by each component 208-212 of an application 214 in response to an incident 216. Each component 208-212 emits the associated event 202-206 reporting the incident 216 based on the component's own perspective. Similar to system 100, each event 202-206 is applied to an adapter 218 to adapt or transform each event 202-206 into a format (adapted events 220-224) that can be understood by an analysis engine 226.
Special detailed knowledge 228 needs to be distributed with the analysis engine 226 so that the analysis engine 226 can understand and interpret the transformed or adapted events 220-224. The analysis engine 226 emits a summary event 230 that is received by the event consumer 232. General knowledge 234 is distributed with the event consumer 232 to understand and interpret the summary event to provide an analysis 236, solution or the like.